From c4c6e17df41c9b65304f2bece902c76fdb38a0a3 Mon Sep 17 00:00:00 2001 From: April John Date: Thu, 20 Mar 2025 12:07:20 +0100 Subject: [PATCH] awa --- Cargo.lock | 47 +++++++++-------- Cargo.toml | 2 + src/main.rs | 122 ++++++++++++++++++++++++++++++++++++++++++++- src/quic/client.rs | 4 +- src/quic/mod.rs | 4 +- src/quic/server.rs | 73 +++++++++++++++++++++++++++ 6 files changed, 224 insertions(+), 28 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 501992d..c627c0e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -92,7 +92,7 @@ dependencies = [ "hashbrown 0.15.2", "paste", "static_assertions", - "windows", + "windows 0.58.0", "windows-core 0.58.0", ] @@ -1874,8 +1874,10 @@ dependencies = [ "quinn", "rcgen", "rustls 0.23.23", + "rustls-pemfile 2.2.0", "shadow-rs", "tokio", + "tracing", "trust-dns-resolver", ] @@ -1941,13 +1943,13 @@ dependencies = [ [[package]] name = "hostname" -version = "0.3.1" +version = "0.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3c731c3e10504cc8ed35cfe2f1db4c9274c3d35fa486e3b31df46f068ef3e867" +checksum = "f9c7c7c8ac16c798734b8a24560c1362120597c40d5e1459f09498f8f6c8f2ba" dependencies = [ + "cfg-if", "libc", - "match_cfg", - "winapi", + "windows 0.52.0", ] [[package]] @@ -2151,7 +2153,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b77d01e822461baa8409e156015a1d91735549f0f2c17691bd2d996bef238f7f" dependencies = [ "byteorder-lite", - "quick-error 2.0.1", + "quick-error", ] [[package]] @@ -2452,12 +2454,6 @@ dependencies = [ "libc", ] -[[package]] -name = "match_cfg" -version = "0.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ffbee8634e0d45d258acb448e7eaab3fce7a0a467395d4d9f228e3c1f01fb2e4" - [[package]] name = "memchr" version = "2.7.4" @@ -3214,12 +3210,6 @@ version = "1.0.16" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "afbdc74edc00b6f6a218ca6a5364d6226a259d4b8ea1af4a0ea063f27e179f4d" -[[package]] -name = "quick-error" -version = "1.2.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0" - [[package]] name = "quick-error" version = "2.0.1" @@ -3428,12 +3418,11 @@ checksum = "19b30a45b0cd0bcca8037f3d0dc3421eaf95327a17cad11964fb8179b4fc4832" [[package]] name = "resolv-conf" -version = "0.7.0" +version = "0.7.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "52e44394d2086d010551b14b53b1f24e31647570cd1deb0379e2c21b329aba00" +checksum = "48375394603e3dd4b2d64371f7148fd8c7baa2680e28741f2cb8d23b59e3d4c4" dependencies = [ "hostname", - "quick-error 1.2.3", ] [[package]] @@ -4970,7 +4959,7 @@ dependencies = [ "wasm-bindgen", "web-sys", "wgpu-types", - "windows", + "windows 0.58.0", ] [[package]] @@ -4999,9 +4988,9 @@ dependencies = [ [[package]] name = "widestring" -version = "1.1.0" +version = "1.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7219d36b6eac893fa81e84ebe06485e7dcbb616177469b142df14f1f4deb1311" +checksum = "dd7cf3379ca1aac9eea11fba24fd7e315d621f8dfe35c8d7d2be8b793726e07d" [[package]] name = "winapi" @@ -5034,6 +5023,16 @@ version = "0.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f" +[[package]] +name = "windows" +version = "0.52.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e48a53791691ab099e5e2ad123536d0fff50652600abaf43bbf952894110d0be" +dependencies = [ + "windows-core 0.52.0", + "windows-targets 0.52.6", +] + [[package]] name = "windows" version = "0.58.0" diff --git a/Cargo.toml b/Cargo.toml index e52343b..b9d2c8a 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -22,6 +22,8 @@ rcgen = { version = "0.13" } rustls = { version = "0.23", features = ["prefer-post-quantum"] } shadow-rs = "0.38" tokio = { version = "1.43", features = ["full"] } +rustls-pemfile = "2.2.0" +tracing = "0.1.41" trust-dns-resolver = { version = "0.23.2", features = ["tokio", "tokio-rustls", "rustls", "dns-over-rustls"] } [build-dependencies] diff --git a/src/main.rs b/src/main.rs index d2c2662..9815f5c 100644 --- a/src/main.rs +++ b/src/main.rs @@ -12,17 +12,23 @@ mod quic; use std::fs::File; use std::net::SocketAddr; +use std::path::{Path, PathBuf}; use std::str::FromStr; use bunt::println; use clap::{Parser, Subcommand}; use config::{Config, FileFormat, Source}; -use log::{debug, info}; +use log::{debug, error, info}; use pman::{init_process_manager, ProcessCommand, ProcessManager}; use shadow_rs::shadow; use std::sync::{Arc, Mutex, OnceLock}; +use anyhow::{bail, Context}; +use quinn::crypto::rustls::QuicServerConfig; +use rustls::pki_types::{CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer}; use tokio::{signal, sync::mpsc::Sender}; use trust_dns_resolver::config::{ResolverConfig, ResolverOpts}; use trust_dns_resolver::{Resolver, TokioAsyncResolver}; +use crate::quic::ALPN_QUIC_HTTP; +use crate::quic::server::handle_connection; shadow!(build); @@ -53,6 +59,29 @@ enum Commands { #[command(about = "Start client as GUI")] GuiClient, Devtest, + Server { + /// file to log TLS keys to for debugging + #[clap(long = "keylog")] + keylog: bool, + /// TLS private key in PEM format + #[clap(short = 'k', long = "key", requires = "cert")] + key: Option, + /// TLS certificate in PEM format + #[clap(short = 'c', long = "cert", requires = "key")] + cert: Option, + /// Enable stateless retries + #[clap(long = "stateless-retry")] + stateless_retry: bool, + /// Address to listen on + #[clap(long = "listen", default_value = "[::1]:4433")] + listen: SocketAddr, + /// Client address to block + #[clap(long = "block")] + block: Option, + /// Maximum number of concurrent connections to allow + #[clap(long = "connection-limit")] + connection_limit: Option, + } } fn config() -> &'static Config { @@ -131,6 +160,97 @@ async fn main() -> anyhow::Result<()> { } } } + + Commands::Server { + keylog, key, cert, stateless_retry, listen, block, connection_limit + } => { + let (certs, key) = if let (Some(key_path), Some(cert_path)) = (&key, &cert) { + let key = std::fs::read(key_path).context("failed to read private key")?; + let key = if key_path.extension().is_some_and(|x| x == "der") { + PrivateKeyDer::Pkcs8(PrivatePkcs8KeyDer::from(key)) + } else { + rustls_pemfile::private_key(&mut &*key) + .context("malformed PKCS #1 private key")? + .ok_or_else(|| anyhow::Error::msg("no private keys found"))? + }; + let cert_chain = std::fs::read(cert_path).context("failed to read certificate chain")?; + let cert_chain = if cert_path.extension().is_some_and(|x| x == "der") { + vec![CertificateDer::from(cert_chain)] + } else { + rustls_pemfile::certs(&mut &*cert_chain) + .collect::>() + .context("invalid PEM-encoded certificate")? + }; + + (cert_chain, key) + } else { + let default_dir = dirs::data_dir().unwrap(); + let path = default_dir.join("hai-server"); + let cert_path = path.join("cert.der"); + let key_path = path.join("key.der"); + let (cert, key) = match std::fs::read(&cert_path).and_then(|x| Ok((x, std::fs::read(&key_path)?))) { + Ok((cert, key)) => ( + CertificateDer::from(cert), + PrivateKeyDer::try_from(key).map_err(anyhow::Error::msg)?, + ), + Err(ref e) if e.kind() == std::io::ErrorKind::NotFound => { + info!("generating self-signed certificate"); + let cert = rcgen::generate_simple_self_signed(vec!["localhost".into()]).unwrap(); + let key = PrivatePkcs8KeyDer::from(cert.key_pair.serialize_der()); + let cert = cert.cert.into(); + std::fs::create_dir_all(path).context("failed to create certificate directory")?; + std::fs::write(&cert_path, &cert).context("failed to write certificate")?; + std::fs::write(&key_path, key.secret_pkcs8_der()) + .context("failed to write private key")?; + (cert, key.into()) + } + Err(e) => { + bail!("failed to read certificate: {}", e); + } + }; + + (vec![cert], key) + }; + let mut server_crypto = rustls::ServerConfig::builder() + //TODO change to auth + .with_no_client_auth() + .with_single_cert(certs, key)?; + server_crypto.alpn_protocols = ALPN_QUIC_HTTP.iter().map(|&x| x.into()).collect(); + if keylog { + server_crypto.key_log = Arc::new(rustls::KeyLogFile::new()); + } + + let mut server_config = + quinn::ServerConfig::with_crypto(Arc::new(QuicServerConfig::try_from(server_crypto)?)); + let transport_config = Arc::get_mut(&mut server_config.transport).unwrap(); + transport_config.max_concurrent_uni_streams(0_u8.into()); + + let endpoint = quinn::Endpoint::server(server_config, listen)?; + eprintln!("listening on {}", endpoint.local_addr()?); + + while let Some(conn) = endpoint.accept().await { + if connection_limit + .is_some_and(|n| endpoint.open_connections() >= n) + { + info!("refusing due to open connection limit"); + conn.refuse(); + } else if Some(conn.remote_address()) == block { + info!("refusing blocked client IP address"); + conn.refuse(); + } else if stateless_retry && !conn.remote_address_validated() { + info!("requiring connection to validate its address"); + conn.retry().unwrap(); + } else { + info!("accepting connection"); + let fut = handle_connection(conn); + tokio::spawn(async move { + if let Err(e) = fut.await { + error!("connection failed: {reason}", reason = e.to_string()) + } + }); + } + } + } }; //handling anything here for gui wont work diff --git a/src/quic/client.rs b/src/quic/client.rs index 7b42544..e65d327 100644 --- a/src/quic/client.rs +++ b/src/quic/client.rs @@ -11,7 +11,7 @@ use rustls::pki_types::CertificateDer; /// - server_certs: a list of trusted certificates in DER format. fn configure_client( server_certs: Option<&[&[u8]]>, -) -> Result> { +) -> anyhow::Result { if let Some(server_certs) = server_certs { let mut certs = rustls::RootCertStore::empty(); for cert in server_certs { @@ -33,7 +33,7 @@ fn configure_client( pub fn make_client_endpoint( bind_addr: SocketAddr, server_certs: Option<&[&[u8]]>, -) -> Result> { +) -> anyhow::Result { let client_cfg = configure_client(server_certs)?; let mut endpoint = Endpoint::client(bind_addr)?; endpoint.set_default_client_config(client_cfg); diff --git a/src/quic/mod.rs b/src/quic/mod.rs index 92b78e2..2fd7691 100644 --- a/src/quic/mod.rs +++ b/src/quic/mod.rs @@ -1,2 +1,4 @@ pub(crate) mod server; -pub(crate) mod client; \ No newline at end of file +pub(crate) mod client; + +pub const ALPN_QUIC_HTTP: &[&[u8]] = &[b"hq-29"]; \ No newline at end of file diff --git a/src/quic/server.rs b/src/quic/server.rs index 4e1a77d..b2e11f3 100644 --- a/src/quic/server.rs +++ b/src/quic/server.rs @@ -1,9 +1,13 @@ use std::error::Error; +use std::fmt::Debug; use std::net::SocketAddr; use std::sync::Arc; +use anyhow::anyhow; +use log::{error, info}; use quinn::{Endpoint, ServerConfig}; use rustls::pki_types::{CertificateDer, PrivatePkcs8KeyDer}; use rustls::pki_types::pem::PemObject; +use tracing::{info_span, Instrument}; /// Constructs a QUIC endpoint configured to listen for incoming connections on a certain address /// and port. @@ -45,4 +49,73 @@ fn configure_server( transport_config.max_concurrent_uni_streams(0_u8.into()); Ok((server_config, cert_der)) +} + +pub async fn handle_connection(conn: quinn::Incoming) -> anyhow::Result<()> { + let connection = conn.await?; + let span = info_span!( + "connection", + remote = %connection.remote_address(), + protocol = %connection + .handshake_data() + .unwrap() + .downcast::().unwrap() + .protocol + .map_or_else(|| "".into(), |x| String::from_utf8_lossy(&x).into_owned()) + ); + async { + info!("established"); + + // Each stream initiated by the client constitutes a new request. + loop { + let stream = connection.accept_bi().await; + let stream = match stream { + Err(quinn::ConnectionError::ApplicationClosed { .. }) => { + info!("connection closed"); + return Ok(()); + } + Err(e) => { + return Err(e); + } + Ok(s) => s, + }; + let fut = handle_request(stream); + tokio::spawn( + async move { + if let Err(e) = fut.await { + error!("failed: {reason}", reason = e.to_string()); + } + } + .instrument(info_span!("request")), + ); + } + } + .instrument(span) + .await?; + Ok(()) +} + +async fn handle_request( + (mut send, mut recv): (quinn::SendStream, quinn::RecvStream), +) -> anyhow::Result<()> { + let req = recv + .read_to_end(64 * 1024) + .await + .map_err(|e| anyhow!("failed reading request: {}", e))?; + let mut escaped = String::new(); + for &x in &req[..] { + let part = std::ascii::escape_default(x).collect::>(); + escaped.push_str(std::str::from_utf8(&part)?); + } + tracing::info!(content = %escaped); + // Execute the request + let resp = "Hello World {}"; + // Write the response + send.write_all(&resp.as_bytes()) + .await + .map_err(|e| anyhow!("failed to send response: {}", e))?; + // Gracefully terminate the stream + send.finish()?; + info!("complete"); + Ok(()) } \ No newline at end of file